ba6e6307f89fa58ee8decc698d40062a

PE Executable

MD5: ba6e6307f89fa58ee8decc698d40062a

Size: 1.51 MB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

1.51 MB · 1,513,472 B

Hashes

MD5 ba6e6307f89fa58ee8decc698d40062a Sha1 d1edd21ab466c2d1ae4f0dc67432d1e839261a87 Sha256 052f0caff530a67f9a17df5795806d9b01a551f309e434cd4eb92fba8e024051 Sha384 d65a8f6c2dddba1eed769a3cae0f335731fa709749fa8320cf57af108aab6195ec4895d5cbcaa63feaf59518da34fca2 Sha512 002cc288159b4bbb129e46a045abb12ddfe21b684102620ee3105bcd297127310d75dba874c5189ca2aa2bbe92d227e3bfda3dcdeb1b872f3cabf90e7e32100d SSDeep 24576:Xa+ZW0rXdUTT1y4eljhTIAqKfySMfk5/uWVKEzyC/1WoNJhvk:X/WMXdUxGvMkcE3/EoR TLSH 2E65F196FBD7EE61E38E0E3881732D4787E6D4251173E30A488B7AE44C9B72D5812397

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Low

12 files

EXEba6e6307f89fa58ee8decc698d40062a

Structure

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINRT_MANIFEST

BINID:0001

BINID:0

BIN.Net Resources

DLLPrivacyShield.dll

Structure

BIN.Net Resources

BINDECRYPT-DLL&&

BINResources

BINRT_VERSION

BINID:0001

BINID:0

ZIPLX_Swys-YN5ck.zip

EXEgff.exe

Structure

BIN.Net Resources

LISTILRepack.List

BINResources

BINRT_VERSION

BINID:0001

BINID:0

LISTILRepack.List

BINL×XØ͌̄̋B̸̂͒KͧO̷ͫЖͨ̍̒О̶̟χ̪̒͂̕ё͈̦̬с̅͑Е̨͇ͣ̅X̨ʟ̝͑Е̥ͣТ͙͙і̶͖Μ̬̈1

STICH beta

No STICH Path has been generated for this analysis yet.

6 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 6

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	LX_Swys-YN5ck
Full Name	LX_Swys-YN5ck
EntryPoint	System.Void qpmodel.logic.Program::<Main>()
Scope Name	LX_Swys-YN5ck
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	LX_Swys-YN5ck
Assembly Version	1.15.38.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.7.2
Total Strings	17
Main Method	System.Void qpmodel.logic.Program::<Main>()
Main IL Instruction Count	6
Main IL	`call System.Threading.Tasks.Task qpmodel.logic.Program::Main() callvirt System.Runtime.CompilerServices.TaskAwaiter System.Threading.Tasks.Task::GetAwaiter() stloc.0 <null> ldloca.s V_0 call System.Void System.Runtime.CompilerServices.TaskAwaiter::GetResult() ret <null>`
Module Name	LX_Swys-YN5ck
Full Name	LX_Swys-YN5ck
EntryPoint	System.Void qpmodel.logic.Program::<Main>()
Scope Name	LX_Swys-YN5ck
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	LX_Swys-YN5ck
Assembly Version	1.15.38.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.7.2
Total Strings	17
Main Method	System.Void qpmodel.logic.Program::<Main>()
Main IL Instruction Count	6
Main IL	`call System.Threading.Tasks.Task qpmodel.logic.Program::Main() callvirt System.Runtime.CompilerServices.TaskAwaiter System.Threading.Tasks.Task::GetAwaiter() stloc.0 <null> ldloca.s V_0 call System.Void System.Runtime.CompilerServices.TaskAwaiter::GetResult() ret <null>`

12 files

EXEba6e6307f89fa58ee8decc698d40062a

Structure

BINResources

BIN.Net Resources

No malware configuration was found at this point.

You must be signed in to view YARA rules.